fix(freshness): surface silent failures when pulling latest

queryFileContent threw on octokit errors (stale SHA 404, expired token,
network blip) and the rejection bubbled up unhandled through pullLatest
and onBadgeClick, leaving the badge stuck on "Outdated" with no log or
toast. Wrap the octokit call, log on failure, clear the cached SHA so
the next click re-resolves it, and show an error toast.

Also fix a dead `if (!user || !repo) { null }` that did nothing.

src/modules/repo/services/repo.ts

@@ -121,20 +121,23 @@ export const queryFileContent = async (
   repo: string,
   sha: string
 ) => {
-  const octokit = await getOctokit()
-
   if (!user || !repo) {
-    null
+    return null
   }
 
-  const file = await octokit.request(
-    "GET /repos/{owner}/{repo}/git/blobs/{file_sha}",
-    {
-      owner: user,
-      repo: repo,
-      file_sha: sha
-    }
-  )
-
-  return file?.data.content ?? null
+  try {
+    const octokit = await getOctokit()
+    const file = await octokit.request(
+      "GET /repos/{owner}/{repo}/git/blobs/{file_sha}",
+      {
+        owner: user,
+        repo: repo,
+        file_sha: sha
+      }
+    )
+    return file?.data.content ?? null
+  } catch (error) {
+    console.warn("queryFileContent failed", { user, repo, sha, error })
+    return null
+  }
 }